Advanced interview questions in Docker & Kubernetes
What is the OCI and why do its specs matter?
OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.
Trace a container process's syscalls from the host
Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.
Run a container as a non-root user
Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.
Pass build-time secrets securely with BuildKit
Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.
Distroless images: benefits and trade-offs
Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.
Structuring Compose files across environments
A base compose.yaml plus override files, the default override auto-merge, and explicit -f flags or extends per environment.
Optimizing Dockerfile layer caching
Order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.
Docker Compose profiles for optional services
Profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.
Vulnerability scanning as a deploy gate
Scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.
Reducing cross-region image pull costs
A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.
Scheduler filtering and scoring phases
Filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.
CRDs and the Operator pattern
CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.
Tuning maxSurge and maxUnavailable
MaxSurge allows Pods above desired; maxUnavailable allows Pods below desired during update. For zero downtime and speed, set maxUnavailable 0 and maxSurge high (e.g. 100%).
Stalled rollouts and progressDeadlineSeconds
With maxUnavailable respected, the rollout pauses partway and old Pods keep serving; progressDeadlineSeconds marks the Deployment as failed after no progress for that window.
Spreading Pods one-per-node for availability
Use required podAntiAffinity with topologyKey kubernetes.io/hostname matching the Deployment's own pod labels, so the scheduler refuses to co-locate two Pods on a node.
kube-proxy and iptables vs IPVS modes
Kube-proxy watches Services/endpoints and programs node rules so ClusterIP traffic is DNAT'd to a backend Pod; iptables uses sequential rule chains, IPVS uses a hash table with real…
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies.
Ingress resource vs Ingress controller
The Ingress resource is declarative routing rules; the controller is the running proxy (NGINX, etc.) that reads them and serves traffic.
How do you inject secrets from an external store at runtime?
Use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.
What do immutable ConfigMaps and Secrets solve?
Setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles